Create one new index for eah type of entry

Elastic Stack Elasticsearch
,
1

Dear all, I have an ELK 7.8.0 server with syslog and cisco module enabled from Filebeat.

At the moment I'm receiving data from:

  • Linux servers (syslog)
  • Cisco ASA (filebeat, cisco module, asa data set)
  • Cisco IOS (filebeat, cisco module, ios data set)

All of these data point to filebeat-* index pattern, and filebeat is the default index with 50 GB.

Please, I have two questions:

  1. Should I have to create a new index to store data coming from Linux servers, another for Cisco ASA and the last one for Cisco IOS ??? Or it's the same to point all of them to filebeat-* ???

  2. In case I create new indexes defining index templates, do I have to define every field name and type from each source??? I think this is hard to do taking into account Cisco ASA, Cisco IOS and Linux servers have several type of logs.

image
image822×498 31.7 KB

Special thanks!!!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.